Analyzing network traffic includes identifying, by a computer related to an enterprise, an endpoint outside of the enterprise of a network connection between a resource of the enterprise and the endpoint; and autonomically determining, by the computer related to the enterprise, when the endpoint is associated with a cloud service provider. An indication that the endpoint is associated with the cloud service provider can then be stored by the computer related to the enterprise.